claimeth[.]vip

The domain claimeth.vip was identified as a brand impersonation phishing site, specifically targeting users of the Lido protocol. This threat type involves creating a fraudulent website that mimics the appearance and branding of a legitimate service to trick users into connecting their wallets or providing sensitive information. The page title, 'Check Eligibility for 30 ETH Airdrop | Lido', is a classic lure designed to exploit the promise of free cryptocurrency, a common tactic in drainer kit operations.

Technical analysis reveals several red flags. VirusTotal scores this domain with 11 out of 95 security vendors flagging it as malicious, indicating broad consensus among security tools. The domain was registered through NiceNIC International Group Co., Limited, a registrar often associated with low-reputation domains. It resolves to IP address 172.67.167.188, and was created on July 03, 2025, making it very recent. The site lacks an SSL certificate, further undermining its legitimacy. It appears on one security blocklist, though its current status is offline, meaning it may have been taken down or is temporarily inaccessible.

As of this report, claimeth.vip is offline, which likely indicates that hosting providers or authorities have responded to reports. However, the risk remains that the domain could be reactivated or that similar domains will appear. Users who have interacted with this site should immediately revoke any token approvals and monitor their wallets for suspicious activity. PhishDestroy advises against visiting the domain or engaging with any unsolicited airdrop offers. Always verify URLs by checking official sources and using wallet connection prompts only from trusted platforms.